fix(attestation): handle default-only interop for dcap-qvl - #14
Open
ozwaldorf wants to merge 2 commits into
Open
fix(attestation): handle default-only interop for dcap-qvl#14ozwaldorf wants to merge 2 commits into
ozwaldorf wants to merge 2 commits into
Conversation
The package is CJS with a trailing module.exports, so bundlers that cannot statically detect its named exports surface it as default only. Destructuring QuoteVerifier then yielded undefined and threw inside the verify call, which surfaced as a misleading quote verification failure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@phala/dcap-qvlis CJS with a trailingmodule.exports, so bundlers that cannot statically detect its named exports surface it asdefaultonly. DestructuringQuoteVerifierthen yieldedundefined, and the resultingTypeErrorwas wrapped asSGX quote verification failed, pointing at attestation rather than at module resolution.Observed in the frontend dev server:
The Vite dep-optimizer chunk exports only
export default require_src(). Node and a production Rollup build both resolve the named export, so this reproduces only under the dev optimizer.Prefers whichever object actually carries
QuoteVerifier, which covers Node, bundler default-only namespaces, and the Vitest mock (an auto-added emptydefaultwould otherwise win).Verified against the real default-only chunk and in plain Node; 119/119 tests pass.